cyber.gov.au
Referenced sections
- Current filing route. Its turnover option says "equal to or exceeds $3 million," which differs from the Act's "exceeds" wording.
By Sorena AIPublished Updated
Australia Cyber Security Act
Australia Cyber Security Act
Australia Cyber Security Act 2024 hub covering smart device security standards, statements of compliance, reporting, reviews, and overlap.
- Act
- Threshold
- Report
- Reviews
Understand Australia Cyber Security Act
The Cyber Security Act 2024 has four main pathways: consumer smart-device duties, reporting, voluntary coordination of significant incidents, and Cyber Incident Review Board reviews.
Start with the product, entity, payment, or incident in front of you. For ransomware reporting, check whether the entity was impacted by a cyber security incident, received a demand, and made a to the extorting entity or learned that another entity made one on its behalf. The guides identify the legal role, trigger, applicable date, required record, and any separate Security of Critical Infrastructure Act check.
Check product release duties, prepare incident reporting, assess overlap, and plan the evidence for each applicable route.
Quick scan
Commencement view
Part 3 ransomware reporting and Part 5 provisions commenced on 29 May 2025, Part 2 smart-device provisions commenced on 29 November 2025, and the Smart Devices Rules' operative standards commenced on 4 March 2026.
Product and reporting scope
Separate consumer grade checks from ransomware reporting business entity checks and overlap questions.
Evidence and topic guides
Use focused guides for smart device standards, statements of compliance, reports, deadlines, penalties, templates, and cross-market comparisons.
Decisions to make
- 1
Smart devices
Check connectivity, intended or likely household use, Australian consumer acquisition, the six product exclusions, and whether you act as manufacturer or supplier before applying the password, security-issue reporting, support-period, and statement duties. The Australian Consumer Law test can cover a business acquisition, including goods priced at no more than the prescribed $100,000 amount, but excludes goods acquired for resale or for specified production, manufacture, repair, or treatment uses. The statement is a retained regulatory record and need not be physically provided at the point of sale.
- 2
Ransomware reporting
Check whether the entity is responsible for a critical-infrastructure asset covered by Part 2B of the Security of Critical Infrastructure Act 2018, the mandatory cyber incident notification regime for specified assets, or carries on business in Australia above the $3 million previous-year turnover threshold. The turnover limb excludes Commonwealth and State bodies and responsible entities for critical-infrastructure assets. Section 26 says turnover must exceed the threshold. The current government form says "equal to or exceeds $3 million," so an entity at exactly $3 million should confirm the filing position promptly. If the remaining incident, demand, and payment conditions are met, the report is due within 72 hours of the payment or awareness trigger.
- 3
Incident review readiness
Understand how reviews focus on learning from certain cyber security incidents, public reporting, sensitive information redaction, and non-interference with investigations or proceedings.
Key milestones for Australia Cyber Security Act
Use cited milestones to sequence smart device release controls, reporting readiness, and review awareness.
Loading timeline...
Choose the next Cyber Security Act decision
New to the Act? Establish the applicable pathway and legal role first. If scope is already documented, jump to the product control, payment-reporting workflow, evidence pack, deadline, enforcement question, or comparison you need.
Start here: pathway, scope, and roles
Separate smart-device, ransomware, incident-coordination, , and questions before assigning obligations. Then document the product, entity, legal role, and trigger.
Obligations and controls
Apply the current product-security controls, -reporting trigger, legal requirements, and enforcement consequences only after the relevant pathway is established.
Implementation and evidence
Turn the applicable obligations into release gates, statements of compliance, retained technical records, response playbooks, owners, and reusable evidence.
- Australia Cyber Security Act Compliance Guide
- Australia Cyber Security Act Compliance Checklist
- Cyber Security Act 2024 Smart Device Compliance Checklist
- Australia Smart Device Compliance Statement
- Australia Cyber Security Act Statement of Compliance Evidence
- Australia Compliance Statement Evidence Workflow
- Australia Cyber Security Act templates
Commencement dates and ongoing monitoring
Distinguish Act commencement, delayed Smart Devices Rules obligations, event-triggered 72-hour reporting, five-year statement retention, and future statutory review activity.
Compare markets or answer a focused question
Keep Australian evidence distinct when comparing the EU CRA or UK PSTI regime, or go directly to the FAQ when a product, reporting, recordkeeping, or notice question is already known.
Sources
legislation.gov.au
Referenced sections
- Defines when goods are acquired as a consumer, including the price and ordinary-use limbs and the exclusions for resale and specified production, manufacture, repair, or treatment uses.
legislation.gov.au
Referenced sections
- Prescribes $100,000 as the amount used for the Australian Consumer Law goods-acquisition test.
legislation.gov.au
Referenced sections
- Current in-force instrument setting the $3 million turnover threshold, partial-year formula, and required ransomware payment report details.
"the amount of turnover threshold for a business for the previous financial year is $3 million"
legislation.gov.au
Referenced sections
- Current in-force instrument for consumer-grade product scope, exclusions, security controls, statements of compliance, retention, and the 4 March 2026 commencement of Part 2 and Schedule 1.
"Security standards for consumer grade relevant connectable products"
legislation.gov.au
Referenced sections
- Official Act text for commencement and the separate smart-device, ransomware reporting, significant-incident coordination, CIRB, regulatory-power, and review pathways.
"Simplified outline of this Act"
legislation.gov.au
Referenced sections
- Clarifies the regulatory purpose of statements of compliance and that they need not be physically provided with a product at the point of sale.
"Statements of compliance are not required to be provided with the product at point of sale"
legislation.gov.au
Referenced sections
- Supports the hub's SOCI overlap references, including critical infrastructure context for ransomware reporting business entity analysis.
"Security of Critical Infrastructure Act 2018"
Next steps
Assign product-security and ransomware-reporting work
Route product, incident response, legal, and security actions into accountable work. Assessment Autopilot can convert the guidance into owners and evidence requests; Research Copilot can support cited scope or interpretation questions.
- Start with a product, entity, payment event, or incident-review question and route it to the right owner.
- Use Assessment Autopilot to request statement-of-compliance evidence, support period records, reporting playbooks, and review checkpoints.
- Use Research Copilot for cited questions about product scope, reporting business entity status, overlap, or procedure.
- Keep legal interpretation, engineering evidence, and incident reporting records connected to the same cited guidance.
- Open Assessment Autopilot
Turn smart device, ransomware reporting, and evidence requirements into owned tasks and review checkpoints.
- Open Research Copilot
Answer Australia Cyber Security Act scope, timing, and interpretation questions with cited outputs.
Align smart device, ransomware reporting, and milestones across stakeholders.
- Talk through implementation
Review your current process, evidence model, and next implementation steps.